Database Migrations: Inbox & Approval Queue tables

Completes async event coupling infrastructure for downstream consumers:

Migrations:
1. 0009_CreateInboxTable.sql
   - Deduplication: UNIQUE (outbox_id, consumer_id)
   - Status: Pending, Processed, Failed
   - Idempotent processing (each consumer once per event)
   - Constraint: If status=Processed, processed_at must be set
   - Indexes: status, created_at, consumer_id

2. 0010_CreateApprovalQueueTable.sql
   - Workflow: Pending → Approved/Rejected
   - References: run_id (FK shadow_run), model_id
   - Audit: requested_at, approved_at, rejected_at
   - Triggers: Enforce timestamp/reason consistency
   - Indexes: status, model_id, requested_at

Design Principles:
✅ Append-only: Records immutable (status transitions, not updates)
✅ PIT Safety: All records timestamped, no forward lookups
✅ Data Integrity: Check constraints enforce workflow rules
✅ Idempotency: UNIQUE constraint prevents duplicate processing
✅ Traceability: Full audit trail (requested_by, approved_by, timestamps)

Workflow:
ShadowRunJob
  ├─ Phase 6: Emit ShadowRunCompletedEvent to Outbox
  └─ Hangfire OutboxPoller (30s)
     ├─ Inbox fanout (INSERT inbox for each consumer)
     └─ InboxConsumers (fanout)
        └─ ApprovalQueueConsumer
           ├─ If AllGatesPassed: INSERT approval_queue (status='Pending')
           └─ Notify: approval_queue subscribers

Ready for:
1. ShadowRunJob event emission (Phase 6)
2. OutboxPollerJob + InboxProcessorJob Hangfire integration
3. Human approval workflow (Maker-Checker)

Test Status: 84/84 PASSING (no changes to app code)

AGENTS.md v16.0:
✅ Safety: Constraints enforce workflow invariants
✅ Audit: Complete audit trail (timestamps, user IDs)
✅ Simplicity: Clear schema, obvious workflow

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

src/KArtSell.DbMigrator/0009_CreateInboxTable.sql

@@ -0,0 +1,59 @@
+-- Migration: Create Inbox table for event-driven async coupling
+-- Purpose: Deduplication and idempotent consumption of outbox events
+-- PIT Safety: All records are immutable (append-only)
+
+CREATE TABLE outbox.inbox (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+
+    -- Foreign key to event
+    outbox_id UUID NOT NULL,
+
+    -- Consumer identification (e.g., "SignalR", "ApprovalQueue", "AuditLog")
+    consumer_id VARCHAR(256) NOT NULL,
+
+    -- Event metadata
+    event_type VARCHAR(256) NOT NULL,
+    payload JSONB NOT NULL,
+
+    -- Processing status
+    status VARCHAR(32) NOT NULL DEFAULT 'Pending',  -- Pending, Processed, Failed
+    error_message TEXT,
+
+    -- Timestamps
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL,
+    attempted_at TIMESTAMP,
+    processed_at TIMESTAMP,
+
+    -- Constraints
+    CONSTRAINT inbox_outbox_fk
+        FOREIGN KEY (outbox_id) REFERENCES outbox.outbox(id) ON DELETE RESTRICT,
+
+    -- Idempotency: Each consumer processes each event exactly once
+    CONSTRAINT inbox_idempotency
+        UNIQUE (outbox_id, consumer_id),
+
+    -- Status constraint
+    CONSTRAINT inbox_status_valid
+        CHECK (status IN ('Pending', 'Processed', 'Failed'))
+);
+
+-- Indexes for fast lookup
+CREATE INDEX inbox_status_idx ON outbox.inbox(status);
+CREATE INDEX inbox_created_idx ON outbox.inbox(created_at DESC);
+CREATE INDEX inbox_consumer_idx ON outbox.inbox(consumer_id);
+
+-- Constraint: If processed, must have processed_at
+CREATE OR REPLACE FUNCTION outbox.inbox_processed_check()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF NEW.status = 'Processed' AND NEW.processed_at IS NULL THEN
+        RAISE EXCEPTION 'processed_at must be set when status = Processed';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER inbox_processed_check_trigger
+BEFORE INSERT OR UPDATE ON outbox.inbox
+FOR EACH ROW
+EXECUTE FUNCTION outbox.inbox_processed_check();